Air-gapped installations

Weik.io builds each version of an integration once, at the hub, and the sites never resolve anything themselves. That makes an air-gapped installation two settings at the hub: the registry its images come from, and the Maven repository the builder resolves Camel’s dependencies from. Both are given to the first weikio-backend init.

What leaves the hub#

Every image of the stack is pinned by digest and pulled from the registry given at install, Docker Hub unless you give another. Beside that the hub makes three kinds of outbound connections, and an air-gapped installation keeps them inside your network:

• the Maven repositories the builder resolves from, which an air-gapped hub replaces with one mirror
• a Dapr secrets sidecar, when you use an external secret store
• your own systems the telemetry forwarder sends to, when you apply a forwarding configuration

The hub never connects to a Git repository. Your pipelines push changes in with the weikio CLI. A site connects only to the hub on port 443 and to the registry its bundle gives, at the install and at every upgrade.

Images from your registry#

Mirror every image images.env lists into your registry, keeping the upstream paths, and give init the registry with --registry. The release’s images.env and SHA256SUMS are checked as in any install, and IMG is the backend image in your registry. Add the Maven settings below to the same line:

$ docker run --rm -u 1654:1654 -v /opt/weikio:/opt/weikio -e WEIKIO_HOME=/opt/weikio -e Weikio__Keys__Dir=/opt/weikio/keys \
  -e WEIKIO_MASTER_KEY_FILE=/opt/weikio/master.key -e Weikio__Nats__Urls__0=nats://nats:4222 -e WEIKIO_BACKEND_IMAGE=$IMG \
  $IMG weikio-backend init --public-base-url https://acme.example --public-leaf-url wss://nats.acme.example:443 --disk-budget 40GiB \
  --registry registry.acme.example \
  --maven-repository corp=https://maven.acme.example/repository/all,mirror --no-maven-central

The stack’s .env then has WEIKIO_REGISTRY on its line near the top, above the image lines. An upgrade writes the new image lines below it, and upgrade.sh pulls the release’s backend image from it too. A site pulls its images from the registry that WEIKIO_REGISTRY in its bundle’s .env gives.

Maven through one mirror#

The builder runs once per version at the hub: it validates the routes, resolves the jars with Camel’s own dependency resolution, compiles your Java beans and stores every file and jar by its content hash. A site fetches those files from the hub over its one link and needs no Maven, no JBang, no JDK download and no HTTP path out of its network.

--maven-repository id=URL gives a repository the builder may resolve from, and you repeat it for each one. ,mirror after the address marks the one that mirrors everything, and --no-maven-central leaves Maven Central out. Without any --maven-repository, builds use Maven Central and Atlassian’s public repository, and a list you give replaces both.

A repository’s credentials are added in the configuration afterwards: the user name in plain configuration and the password as a project secret, created with weikio secret set <project>/<name> and given as <project>.<name>. Keep that secret in a project the installation never deletes, such as a platform project of its own. Give the hub a repository account that can only read, because a build step can read the credentials in the Maven settings.

Each build step runs isolated and makes TCP connections only to the ports of the repositories, mirror and proxy the hub is set up with. Keeping integrations apart describes the isolation.

Certificates without public DNS#

A hub with no public DNS can’t get its certificates from Let’s Encrypt over the internet. --hub-names-authority platform on the first init signs the hub’s own names from the platform’s own certificate authority, and --authority-names limits that authority to your suffixes, such as corp.example,factory.local. A certificate authority of your own that speaks ACME works too, as Certificates describes. Every site bundle then has the authority’s certificate, so the sites trust the hub without further steps.

The CLI in a closed network#

The install script downloads the weikio CLI from weik.io and checks it against the release’s SHA256SUMS. In a closed network, copy the CLI’s release folder to a server of your own and give the script its address in WEIKIO_CLI_DOWNLOADS_URL.